here is the cf-stub.yml (for security reason, i masked password,keys and certificates:

---
meta:
environment: aws-mycf

director_uuid: f755beb5-ae36-4319-b33d-ad36c99a5c55

networks:
- name: cf1
subnets:
- range: 10.0.16.0/20
reserved:
- 10.0.16.2 - 10.0.16.9
static:
- 10.0.16.10 - 10.0.16.255
gateway: 10.0.16.1
dns:
- 10.0.0.2
cloud_properties:
security_groups:
- cf
subnet: (( properties.template_only.aws.subnet_ids.cf1 ))
- name: cf2
subnets:
- range: 10.0.80.0/20
reserved:
- 10.0.80.2 - 10.0.80.9
static:
- 10.0.80.10 - 10.0.80.255
gateway: 10.0.80.1
dns:
- 10.0.0.2
cloud_properties:
security_groups:
- cf
subnet: (( properties.template_only.aws.subnet_ids.cf2 ))

properties:
template_only:
aws:
access_key_id: xxxxxxxxxxxxx
secret_access_key: xxxxxxxxxxxxxxxxxxxxxxx
availability_zone: us-west-2a
availability_zone2: us-west-2b
subnet_ids:
cf1: subnet-a3c43ed5
cf2: subnet-7f61c01b

domain: jhaws.testcloud.io
system_domain: cf.jhaws.testcloud.io
system_domain_organization: testorg
app_domains:
- cfapps.jhaws.testcloud.io

ssl:
skip_cert_verify: true

cc:
droplets:
droplet_directory_key: xxxxxx
buildpacks:
buildpack_directory_key: xxxxxx
staging_upload_user: admin
staging_upload_password: xxxxxx
bulk_api_password: xxxxxx
db_encryption_key: xxxxxx
ccdb:
db_scheme: postgres
roles:
- tag: admin
name: admin
password: xxxxxx
databases:
- tag: cc
name: ccdb
address: 10.0.16.51
port: 5524
consul:
encrypt_keys:
- xxxxxx
ca_cert: |
-----BEGIN CERTIFICATE-----
MIIFBzCCAu+gAwIBAgIBATANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDEwhjb25z
dWxDQTAeFw0xNjA0MjEyMjQ3MzNaFw0yNjA0MjEyMjQ3MzRaMBMxETAPBgNVBAMT
CGNvbnN1bENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA6NBB+vnK
-----END CERTIFICATE-----
server_cert: |
-----BEGIN CERTIFICATE-----
MIIEMDCCAhigAwIBAgIRAIAS8a+GUM/TY1wCaEvK6fAwDQYJKoZIhvcNAQELBQAw
EzERMA8GA1UEAxMIY29uc3VsQ0EwHhcNMTYwNDIxMjI0NzM0WhcNMTgwNDIxMjI0
NzM0WjAhMR8wHQYDVQQDExZzZXJ2ZXIuZGMxLmNmLmludGVybmFsMIIBIjANBgkq
-----END CERTIFICATE-----
server_key: |
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA+HnbOLR7Awhuwe5Ev/fBacWG97Bygr0TvD7Oo8yi6k9vKyfn
FnSWe+FXrcwdUylYze60mlkU5S5Yu/IIHdhE37ZejdlCa8MbRno+Qp4FfQc698VI
beH921d4Lt6wBEBcVH2nL1xEGm6ccL4eKzf5i4BJfAjaBAJ4/WdArFRjB4tlVaVH
-----END RSA PRIVATE KEY-----
agent_cert: |
-----BEGIN CERTIFICATE-----
MIIEJTCCAg2gAwIBAgIQZc8e6UvMejQPcA8KYx7TLTANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDEwhjb25zdWxDQTAeFw0xNjA0MjEyMjQ3MzRaFw0xODA0MjEyMjQ3
MzRaMBcxFTATBgNVBAMTDGNvbnN1bCBhZ2VudDCCASIwDQYJKoZIhvcNAQEBBQAD
-----END CERTIFICATE-----
agent_key: |
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEA27tqd97u/sBZ9UClFJdsgT3NFe4bS4hOrfWT3yydT3O/P+Eq
1ebowmQyp+Xg+EJmKdCoKZP6QEMlP96fCyHVkEEWlGEAD57Dx9UUydKg69dbbkyP
2XcfthhM2FDWGwL6kEZnFOUVPT5YZUzBsjJO8aGOwTNP7LrvJ3W0NW7FUA5yT1xk
-----END RSA PRIVATE KEY-----
loggregator_endpoint:
shared_secret: xxxxxx
nats:
user: admin
password: xxxxxx
router:
status:
user: admin
password: xxxxxx
uaa:
admin:
client_secret: xxxxxx
cc:
client_secret: xxxxxx
clients:
cc_routing:
secret: xxxxxx
cloud_controller_username_lookup:
secret: xxxxxx
doppler:
secret: xxxxxx
gorouter:
secret: xxxxxx
tcp_emitter:
secret: xxxxxx
tcp_router:
secret: xxxxxx
login:
secret: xxxxxx
notifications:
secret: xxxxxx
jwt:
signing_key: |
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAts3Omn1up4wLZWUTev7eeGwS4SKFb44GIboerrNQsnR+RdgF
tsqt2Cpt79WldM+ECFm6+a+1kE1bcRcFBlUhYs4X8AvpmB7k0y57krO9zwXe/Prc
f6CNIqUsE8WPJhywMiNM4qzDkzZPqeDksve1UTvmPPy+fdyFD1qVHAnZmo79FWOP
-----END RSA PRIVATE KEY-----
verification_key: |
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAts3Omn1up4wLZWUTev7e
eGwS4SKFb44GIboerrNQsnR+RdgFtsqt2Cpt79WldM+ECFm6+a+1kE1bcRcFBlUh
Ys4X8AvpmsdffdfffrO9zwXe/Prcf6CNIqUsE8WPJhywMiNM4qzDkzZPqeDksve1
-----END PUBLIC KEY-----
scim:
users:
- admin|xxxxxx|scim.write,scim.read,openid,cloud_controller.admin,doppler.firehose
uaadb:
db_scheme: postgres
roles:
- tag: admin
name: admin
password: xxxxxx
databases:
- tag: uaa
name: uaadb
address: 10.0.16.51
port: 5524